Mediamath Authentication

generated: '2026-08-13'
method: searched
source: openapi/mediamath-ad-servers-api-openapi.yml, openapi/mediamath-advertisers-api-openapi.yml, openapi/mediamath-agencies-api-openapi.yml,
  openapi/mediamath-atomic-creatives-api-openapi.yml, openapi/mediamath-audience-segments-api-openapi.yml,
  openapi/mediamath-audience-vendors-api-openapi.yml, openapi/mediamath-bof-config-api-openapi.yml, openapi/mediamath-byoa-api-openapi.yml,
  openapi/mediamath-campaign-plans-api-openapi.yml, openapi/mediamath-campaigns-api-openapi.yml, openapi/mediamath-campaigns-budget-flights-api-openapi.yml,
  openapi/mediamath-component-creatives-api-openapi.yml ... ; https://apidocs.mediamath.com/guides/authentication
summary:
  types:
  - apiKey
  - oauth2
  api_key_in:
  - header
  oauth2_flows:
  - authorizationCode
  - clientCredentials
  - password
schemes:
- name: Auth0
  type: oauth2
  flows:
  - flow: authorizationCode
    authorizationUrl: https://auth.mediamath.com/authorize
    tokenUrl: https://auth.mediamath.com/oauth/token
    scopes: 2
  sources:
  - openapi/mediamath-ad-servers-api-openapi.yml
  - openapi/mediamath-advertisers-api-openapi.yml
  - openapi/mediamath-agencies-api-openapi.yml
  - openapi/mediamath-atomic-creatives-api-openapi.yml
  - openapi/mediamath-audience-vendors-api-openapi.yml
  - openapi/mediamath-campaign-plans-api-openapi.yml
  - openapi/mediamath-campaigns-api-openapi.yml
  - openapi/mediamath-campaigns-budget-flights-api-openapi.yml
  - openapi/mediamath-concepts-api-openapi.yml
  - openapi/mediamath-contracts-api-openapi.yml
  - openapi/mediamath-creatives-api-openapi.yml
  - openapi/mediamath-currency-rates-api-openapi.yml
  - openapi/mediamath-datasets-api-openapi.yml
  - openapi/mediamath-enterprise-controls-api-openapi.yml
  - openapi/mediamath-general-api-openapi.yml
  - openapi/mediamath-marketplaces-api-openapi.yml
  - openapi/mediamath-new-strategy-groups-api-openapi.yml
  - openapi/mediamath-new-strategy-plans-api-openapi.yml
  - openapi/mediamath-organizations-api-openapi.yml
  - openapi/mediamath-pixel-bundles-api-openapi.yml
  - openapi/mediamath-pixel-providers-api-openapi.yml
  - openapi/mediamath-segment-groups-api-openapi.yml
  - openapi/mediamath-site-lists-api-openapi.yml
  - openapi/mediamath-strategies-api-openapi.yml
  - openapi/mediamath-strategy-parameters-api-openapi.yml
  - openapi/mediamath-strategy-templates-api-openapi.yml
  - openapi/mediamath-supply-sources-api-openapi.yml
  - openapi/mediamath-targeting-api-openapi.yml
  - openapi/mediamath-targeting-attachments-api-openapi.yml
  - openapi/mediamath-targeting-segment-objectives-api-openapi.yml
  - openapi/mediamath-targeting-segments-api-openapi.yml
  - openapi/mediamath-timezones-api-openapi.yml
  - openapi/mediamath-user-permissions-api-openapi.yml
  - openapi/mediamath-users-api-openapi.yml
  - openapi/mediamath-vendor-contracts-api-openapi.yml
  - openapi/mediamath-vendors-api-openapi.yml
  - openapi/mediamath-verticals-api-openapi.yml
- name: OAuth2
  type: oauth2
  flows:
  - flow: password
    tokenUrl: https://auth.mediamath.com/oauth/token
    scopes: 0
  sources:
  - openapi/mediamath-audience-segments-api-openapi.yml
  - openapi/mediamath-bof-config-api-openapi.yml
  - openapi/mediamath-byoa-api-openapi.yml
  - openapi/mediamath-video-creatives-api-openapi.yml
- name: Cookie_Auth
  type: apiKey
  in: header
  parameter: Cookie
  description: 'Cookie: adama_sesion=`cookie-id`. Security: API Key - Please note that adama_cookie support
    is being deprecated and will be removed in our future v2 API.'
  sources:
  - openapi/mediamath-audience-segments-api-openapi.yml
  - openapi/mediamath-bof-config-api-openapi.yml
- name: adama-session-header
  type: apiKey
  in: header
  parameter: adama_session
  description: 'Authentication is provided through OAuth2. You''ll need to request a Client ID and Secret
    key.


    After Authentication is established make a request to https://api.mediamath.com/api/v2.0/session with
    the Authorization:"Bearer ACCESS_TOKEN header, and copy the adama_session cookie header from the response.
    Use both the Authorization:"Bearer ACCESS_TOKEN" header and adama_session= cookie in all future '
  sources:
  - openapi/mediamath-byoa-api-openapi.yml
- name: BearerAuth
  type: apiKey
  in: header
  parameter: Authorization
  description: Type "Bearer" followed by a space and JWT token.
  sources:
  - openapi/mediamath-component-creatives-api-openapi.yml
  - openapi/mediamath-marketplaces-api-v2-openapi.yml
- name: API_Key_-_1
  type: oauth2
  flows:
  - flow: clientCredentials
    tokenUrl: https://auth.mediamath.com/oauth/token
    scopes: 0
  sources:
  - openapi/mediamath-reporting-api-v1-openapi.yml
docs: https://apidocs.mediamath.com/guides/authentication
documented:
  provider: Auth0
  authorize_endpoint: https://auth.mediamath.com/authorize
  token_endpoint: https://auth.mediamath.com/oauth/token
  audience: https://api.mediamath.com/
  header: 'Authorization: Bearer <access_token>'
  token_lifetime_seconds: 86400
  grants:
  - authorization_code
  - password
  - refresh_token
  credential_issuance: Client ID and Client Secret are issued by MediaMath Support (https://support.infillion.com/s/submit-a-case).
    There is no self-service developer app registration.
  dynamic_registration: Dynamically registered clients support the Authorization Code Grant only, because
    most MediaMath APIs require a user context.
  refresh: Include the offline_access scope on the authorize/token request to receive a refresh_token;
    exchange with grant_type=refresh_token.
  legacy_dual_auth:
    required: true
    reason: Migration to OAuth2 is incomplete; some APIs still require the platform session cookie.
    procedure: 'GET https://api.mediamath.com/api/v2.0/session with Authorization: Bearer <token>, copy
      the adama_session cookie from the response, and send BOTH the Authorization header and the adama_session
      cookie on all subsequent requests.'
    appears_in_specs_as:
    - Cookie_Auth
    - Cookie_auth
    - adama-session-header
  key_hygiene: Provider requires application owners to protect client IDs and secrets and to be prepared
    to rotate them if compromised.
  mfa: Platform accounts support SMS and TOTP MFA; TOTP strongly recommended. MFA posture is inherited
    down organization -> agency -> advertiser.
  proof_of_concept_tools:
  - https://apidocs.mediamath.com/assets/how_to_use_oauth_poc.c05993b76162fd828216e0ac10239d22176634024be3ab9c1cab121d2a6aa9bf.9817d8cf.pdf
x-evidence:
  fetched: '2026-08-13'
  url: https://apidocs.mediamath.com/guides/authentication.md
  http_status: 200